Detections
Analytics

5.6.6 Apply least privilege firewall rules to GKE worker nodes

Information

Apply least privilege VPC firewall rules and firewall policies to GKE worker nodes to restrict ingress and egress traffic to approved sources, destinations, ports, and protocols. Firewall rules should target only the intended GKE nodes by using appropriate network tags, service accounts, or other approved targeting methods.

GKE worker nodes are Compute Engine VMs in a VPC network, so VPC firewall rules and firewall policies apply at the node level. Limiting node ingress reduces exposure to unnecessary management ports, NodePort ranges, workload ports, and unapproved source networks. Limiting egress helps reduce the ability of a compromised workload or node to reach unauthorized internal systems, internet destinations, or unmanaged services.

GKE creates default firewall rules for required cluster functionality, and additional rules can be created for Services such as load balancers. Custom firewall rules should not be overly permissive or override required GKE rules in a way that increases exposure or breaks cluster operations. Node level firewalling should also be used with Kubernetes Network Policies where Pod level traffic control is required.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Apply least privilege firewall controls to GKE worker nodes by reducing broad ingress and egress access while preserving required cluster functionality. Firewall rules should be targeted carefully so they protect the intended node pools without unintentionally affecting unrelated VM instances in the same VPC.

 -

Update GKE worker node firewall rules so only approved sources, destinations, ports, and protocols are allowed.

 -

Target firewall rules to the specific GKE node tags or node service accounts used by the cluster. Avoid rules that apply broadly to the entire VPC unless there is a documented requirement.

 -

Remove or replace overly permissive rules, especially rules that allow broad ingress from 0.0.0.0/0, unnecessary management ports, broad NodePort ranges, or unrestricted egress.

 -

Create or update firewall rules to allow only required traffic, using approved source ranges, destination ranges, ports, protocols, node tags, or node service accounts.

 -

Preserve required GKE created firewall rules for cluster operations, load balancers, health checks, control plane to node communication, DNS, logging, monitoring, and image pulls unless replacement rules have been fully tested.

Impact:

Restrictive firewall rules can affect node registration, control plane to node communication, health checks, load balancer Services, DNS, image pulls, logging, monitoring, and required Google API access. Rules should be tested before enforcement and targeted carefully so they do not unintentionally affect other instances that share the same network tag, service account, subnet, or firewall policy target.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.5

Plugin: GCP

Control ID: a87ca070aee0098ce84753b1bfa16a1ba5c34121dbe696230c259ab867b90acc